Conditional SPL

[japger_splunk]

How do you build a query that takes two different SPL paths based on a condition within the data? Example: Write the results of a query to a summary index only if the search name does not begin with "TEST"?

[lakshman239]

if you have a summary generating search with search_name!=TEST* will that not work for you?

[japger_splunk]

Good point. I believe your example is a one-way condition but please correct me if I misunderstand. "Only do this if this condition is met" versus "Do this if it's met or do this if it's not met".

[lakshman239]

I normally prefer to write "only do this if this condition is met", so I know the condition/scenario of the search and helps in troubleshooting.

[japger_splunk · Accepted solution]

Use multireport to steer your search down the desired path.

| makeresults 1
|eval search_name="TEST-RiskRule - DDNS Activity Detected - System"
|multireport [|search NOT search_name="TEST*"|collect index=myindex] [|search search_name="TEST*"|collect index=myindex testmode=true]